https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:35:38.391140+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-87911 CVE-2026-87911 — Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awsl… 2026-10-05T22:35:38.412160+00:00

Affected: AWS Labs postgres MCP Server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.

To remediate this issue, users should upgrade to version 1.1.7 or later.